 Feedback
|
Table Of Contents
Prerequisites for NAC—Auth Fail Open
Restrictions for NAC—Auth Fail Open
Information About Network Admission Control
Controlling Admission to a Network
Network Admission Control When the AAA Server Is Unreachable
How to Configure NAC—Auth Fail Open
Configuring a NAC Rule-Associated Policy Globally for a Device
Applying a NAC Policy to a Specific Interface
Configuring Authentication and Authorization Methods
Configuring RADIUS Server Parameters
Determining When the RADIUS Server Is Unavailable
Displaying the Status of the Configured AAA Servers
Displaying the NAC Configuration
Displaying the EAPoUDP Configuration
Configuration Examples for NAC—Auth Fail Open
Sample NAC—Auth Fail Open Configuration: Example
Sample RADIUS Server Configuration: Example
show ip admission configuration Output: Example
show aaa servers Output: Example
Feature Information for NAC—Auth Fail Open
NAC—Auth Fail Open
First Published: November 17, 2006Last Updated: November 17, 2006In network admission control (NAC) deployments, authentication, authorization, and accounting (AAA) servers validate the antivirus status of clients before granting network access. This process is called posture validation. If the AAA server is unreachable, clients will not have access to the network. The NAC—Auth Fail Open feature enables the administrator to apply a policy that allows users to have network access when the AAA server is unreachable. The administrator can configure a global policy that applies to a device, or a rule-based policy that applies to a specific interface.
When the AAA server returns to a reachable status, the posture validation process resumes for clients that are using the NAC—Auth Fail Open policy.
Finding Feature Information in This Module
Your Cisco IOS software release may not support all of the features documented in this module. To reach links to specific feature documentation in this module and to see a list of the releases in which each feature is supported, use the "Feature Information for NAC—Auth Fail Open" section.
Finding Support Information for Platforms and Cisco IOS and Catalyst OS Software Images
Use Cisco Feature Navigator to find information about platform support and Cisco IOS and Catalyst OS software image support. To access Cisco Feature Navigator, go to http://www.cisco.com/go/cfn. An account on Cisco.com is not required.
Contents
•
Prerequisites for NAC—Auth Fail Open
•
•
•
•
•
Prerequisites for NAC—Auth Fail Open
You can configure this feature in networks using NAC and an AAA server for security. NAC is implemented on Cisco IOS routers running Cisco IOS Release 12.3(8)T or a later release.
Restrictions for NAC—Auth Fail Open
To apply local policies to a device or an interface when the AAA server is unreachable, you must configure the aaa authorization network default local command.
Information About Network Admission Control
You should understand the following concepts:
•
•
Controlling Admission to a Network
NAC protects networks from endpoint devices or clients (such as PCs or servers) that are infected with viruses by enforcing access control policies that prevent infected devices from adversely affecting the network. It checks the antivirus condition (called posture) of endpoint systems or clients before granting the devices network access. NAC keeps insecure nodes from infecting the network by denying access to noncompliant devices, placing them in a quarantined network segment or giving them restricted access to computing resources.
NAC enables network access devices (NADs) to permit or deny network hosts access to the network based on the state of the antivirus software on the host. This process is called posture validation.
Posture validation consists of the following actions:
•
•
•
Network Admission Control When the AAA Server Is Unreachable
Typical deployments of NAC use a AAA server to validate the client posture and to pass policies to the NAD. If the AAA server is not reachable when the posture validation occurs, the typical response is to deny network access. Using NAC—Auth Fail Open, an administrator can configure a default policy that allows the host at least limited network access while the AAA server is unreachable.
This policy offers these two advantages:
•
•
Note
How to Configure NAC—Auth Fail Open
You can configure NAC—Auth Fail Open policies per interface, or globally for a device. Configuring NAC—Auth Fail Open is optional, and includes the following tasks:
•
•
•
•
•
Configuring a NAC Rule-Associated Policy Globally for a Device
This task creates a NAC rule and associates a policy to be applied while the AAA server is unreachable. You can apply a policy globally to all interfaces on a network access device, if you want to provide the same level of network access to all users who access that device.
Prerequisites
An AAA server must be configured and NAC must be implemented on the NAD.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Applying a NAC Policy to a Specific Interface
An IP admission rule with NAC—Auth Fail Open policies can be attached to an interface. This task attaches a NAC—Auth Fail Open policy to a rule, and applies the rule to a specified interface on a device.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
DETAILED STEPS
Configuring Authentication and Authorization Methods
This task configures the authentication and authorization methods for the device. The access granted using these methods will remain in effect for users who attempt reauthorization while the AAA server is unavailable. These methods must be configured before you configure any policy to be applied to users who try to access the network when the AAA server is unreachable.
SUMMARY STEPS
1.
2.
3.
4.
5.
DETAILED STEPS
Configuring RADIUS Server Parameters
This task configures the identity and parameters of the RADIUS server that provides AAA services to the network access device. To configure RADIUS server parameters, you should understand the following concepts:
•
•
Identifying the RADIUS Server
A RADIUS server can be identified by:
•
•
•
•
The combination of the RADIUS server IP address and a specific UDP port number creates a unique identifier, which enables RADIUS requests to be sent to multiple UDP ports on a server at the same IP address. If two different host entries on the same RADIUS server are configured for the same service—for example, authentication—the second host entry configured acts as the backup to the first one. The RADIUS host entries are tried in the order that they were configured.
Determining When the RADIUS Server Is Unavailable
Because the NAC—Auth Fail Open feature applies a local policy when the RADIUS server is unavailable, you should configure "dead criteria" that identify when the RADIUS server is unavailable. There are two configurable dead criteria:
•
•
If you do not configure the dead criteria, they will be calculated dynamically, based on the server configuration and the number of requests being sent to the server.
You can also configure the number of minutes to wait before attempting to resume communication with a RADIUS server after it has been defined as unavailable.
SUMMARY STEPS
1.
2.
3.
4.
5.
6.
7.
8.
DETAILED STEPS
Displaying the Status of the Configured AAA Servers
This task displays the status of the AAA servers you have configured for the device.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Displaying the NAC Configuration
This task displays the current NAC configuration for the device.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Displaying the EAPoUDP Configuration
This task displays information about the current EAPoUDP configuration for the device, including any NAC—Auth Fail Open policies in effect.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Enabling EOU Logging
A set of new system logs is included in Cisco IOS Release 12.4(11)T. These new logs track the status of the servers defined by the methodlist, and the NAC Auth Fail policy configuration. You should enable EOU logging to generate syslog messages that notify you when the AAA servers defined by the methodlist are unavailable, and display the configuration of the NAC—Auth Fail Open policy. The display shows whether a global or rule-specific policy is configured for the NAD or interface. If no policy is configured, the existing policy is retained.
This task enables EOU logging.
SUMMARY STEPS
1.
2.
DETAILED STEPS
Configuration Examples for NAC—Auth Fail Open
This section contains the following examples:
•
•
•
•
Sample NAC—Auth Fail Open Configuration: Example
The example below shows how to configure the NAC—Auth Fail Open feature:
Switch# configure terminalEnter configuration commands, one per line. End with CNTL/Z.Switch(config)# ip admission name AAA_DOWN eapoudp event timeout aaa policy identityglobal_policySwitch(config)# aaa new-modelSwitch(config)# aaa authorization network default localSwitch(config)# aaa authentication eou default group radiusSwitch(config)# identity policy global_policySwitch(config-identity-policy)# acSwitch(config-identity-policy)# access-group global_aclSwitch(config)# ip access-list extended global_aclSwitch(config-ext-nacl)# permit ip any anySwitch(config-ext-nacl)# exitSample RADIUS Server Configuration: Example
The example below shows that the RADIUS server will be considered unreachable after 3 unsuccessful tries:
Switch(config)# radius-server host 10.0.0.4 test username administrator idle-time 1 keysampleSwitch(config)# radius-server dead-criteria tries 3Switch(config)# radius-server deadtime 30Switch(config)# radius-server vsa send authenticationSwitch(config)# radius-server attribute 8 include-in-access-reqSwitch(config)# int fastEthernet 2/13Switch(config-if)# ip admission AAA_DOWNSwitch(config-if)# exitshow ip admission configuration Output: Example
The following example shows that a policy called "global policy" has been configured for use when the AAA server is unreachable:
Switch# show ip admission configurationAuthentication global cache time is 60 minutes Authentication global absolute time is 0minutes Authentication global init state time is 2 minutes Authentication Proxy Watch-listis disabledAuthentication Proxy Rule ConfigurationAuth-proxy name AAA_DOWNeapoudp list not specified auth-cache-time 60 minutesIdentity policy name global_policy for AAA fail policyshow eou Output: Example
The example below shows the configuration of the AAA servers defined for a NAC—Auth Fail policy configuration:
Router# show eou ip 10.0.0.1Address : 10.0.0.1 MAC Address : 0001.027c.f364 Interface : Vlan333 ! Authtype is show as AAA DOWN when in AAA is not reachable.AuthType : AAA DOWN ! AAA Down policy name:AAA Down policy : rule_policy Audit Session ID : 00000000011C11830000000311000001 PostureToken : ------- Age(min) : 0 URL Redirect : NO URL REDIRECT URL Redirect ACL : NO URL REDIRECT ACL ACL Name : rule_acl Tag Name : NO TAG NAME User Name : UNKNOWN USER Revalidation Period : 500 Seconds Status Query Period : 300 Seconds Current State : AAA DOWNshow aaa servers Output: Example
The example below shows sample status information for a configured AAA server:
Switch# show aaa serversRADIUS: id 1, priority 1, host 10.0.0.4, auth-port 1645, acct-port 1646State: current UP, duration 5122s, previous duration 9sDead: total time 79s, count 3Authen: request 158, timeouts 14Response: unexpected 1, server error 0, incorrect 0, time 180msTransaction: success 144, failure 1Author: request 0, timeouts 0Response: unexpected 0, server error 0, incorrect 0, time 0msTransaction: success 0, failure 0Account: request 0, timeouts 0Response: unexpected 0, server error 0, incorrect 0, time 0msTransaction: success 0, failure 0Elapsed time since counters last cleared: 2h13mSEOU Logging Output: Example
The example below shows the display when EOU logging is enabled:
Router (config)# eou loggingEOU-5-AAA_DOWN: AAA unreachable.METHODLIST=Default| HOST=17.0.0.1| POLICY=Existing policy retained.EOU-5-AAA_DOWN: AAA unreachable.METHODLIST=Default| HOST=17.0.0.1| POLICY=aaa_unreachable_policyAdditional References
The following sections provide references related to the NAC—Auth Fail Open feature.
Related Documents
Standards
MIBs
RFCs
No new or modified RFCs are supported by this feature, and support for existing RFCs has not been modified by this feature.
—
Technical Assistance
Command Reference
This section documents modified commands only.
ip admission
To create a Layer 3 network admission control rule to be applied to the interface, or to create a policy that can be applied on an interface when the authentication, authorization and accounting (AAA) server is unreachable, use the ip admission command in interface configuration mode. To create a global policy that can be applied on a network access device, use the ip admission command with the optional keywords and argument in global configuration mode. To remove the admission control rule, use the no form of this command.
ip admission admission-name [event timeout aaa policy identity identity-policy-name]
no ip admission admission-name [event timeout aaa policy identity identity-policy-name]
Syntax Description
Command Default
A network admission control rule is not applied to the interface.
Command Modes
Interface configuration
Global configurationCommand History
12.3(8)T
This command was introduced.
12.4(11)T
This command was modified to include the event timeout aaa policy identity keywords and the identity-policy-name argument.
Usage Guidelines
The admission rule defines how you apply admission control.
The optional keywords and argument define the network admission policy to be applied to a network access device or an interface when no AAA server is reachable. The command can be used to associate a default identity policy with Extensible Authentication Protocol over User Datagram Protocol (EAPoUDP) sessions.
Examples
The following example shows how to apply a network admission control rule named "nacrule1" to the interface:
Router (config-if)# ip admission nacrule1The following example shows how to apply an identity policy named "example" to the device when the AAA server is unreachable:
Router (config)# ip admission event timeout aaa policy identity exampleRelated Commands
ip admission name
To create an IP network admission control rule, use the ip admission name command in global configuration mode. To remove the network admission control rule, use the no form of this command.
ip admission name admission-name [eapoudp [bypass] | proxy {ftp | http | telnet} | service-policy type tag {service-policy-name}] [list {acl | acl-name}] [event] [timeout aaa] [policy identity {identity-policy-name}]
no ip admission name admission-name [eapoudp [bypass] | proxy {ftp | http | telnet} | service-policy type tag {service-policy-name}] [list {acl | acl-name}] [event] [timeout aaa] [policy identity {identity-policy-name}]
Syntax Description
Command Default
An IP network admission control rule is not created.
Command Modes
Global configuration
Command History
Usage Guidelines
The admission rule defines how you apply admission control.
You can associate the named rule with an ACL, providing control over which hosts use the admission control feature. If no standard access list is defined, the named admission rule intercepts IP traffic from all hosts whose connection-initiating packets are received at the configured interface.
The bypass keyword allows an administrator the choice of not having to use the EAPoUDP-based posture validation for the hosts that are trying to connect on the port. The bypass can be used if an administrator knows that the hosts that are connected on the port do not have the Cisco Trust Agent client installed.
The service-policy type tag {service-policy-name} keywords and argument allow you to associate the service policy of the type tag with the IP admission rule. On the network access device (NAD), a set of policies can be associated with an arbitrary tag string, and if the AAA server sends the same tag in response to the posture validation or authentication response, the policies that are associated with the tag can be applied on the host. The service-policy keyword is an optional keyword, and if the service policy is not associated with the IP admission name, the policies that are received from the AAA server are applied on the host.
The list keyword option allows you to apply a standard, extended (1 through 199) or named access list to a named admission control rule. IP connections that are initiated by hosts in the access list are intercepted by the admission control feature.
The event keyword option allows you to specify the condition that triggered application of an identity policy.
The timeout aaa keyword option specifies that the AAA server is unreachable, and this condition is triggering the application of an identity policy.
The policy identity keyword and the identity-policy-name argument allow you to configure application of an identity policy and specify the policy type to be applied while the AAA server is unreachable.
Examples
"Tag and Template" Feature Examples:
The following example shows that an IP admission control rule is named "greentree" and that it is associated with ACL "101." Any IP traffic that is destined to a previously configured network (using the access-list command) will be subjected to antivirus state validation using EAPoUDP.
Router (config)# ip admission name greentree eapoudp list 101The following example shows that EAPoUDP bypass has been configured:
Router (config)# ip admission name greentree eapoudp bypass list 101In the following service policy example, tags named "healthy" and "non_healthy" can be received from an AAA server, the policy map is defined on the NAD, and the tag policy type is associated with the IP admission name "greentree."
Class Map Definition for the "healthy class" Type Tag
Router (config)# class-map type tag healthy_classRouter(config-cmap)# match tag healthyRouter(config-cmap)# endClass Map Definition for the "non_healthy_class" Type Tag
Router (config)# class-map type tag non_healthy_classRouter (config-cmap)# match tag non_healthyRouter (config-cmap)# endPolicy Map Definition
! The following line will be associated with the IP admission name.Router (config)# policy-map type control tag global_class! The following line refers to the healthy class map that was defined above.Router (config-pmap)# class healthy_classRouter (config-pmap-c)# identity policy healthy_policyRouter(config-pmap-c)# exitThe following line refers to the non_healthy class that was defined above.Router (config-pmap)# class non_healthy_classRouter(config-pmap-c)# identity policy non_healthy_policyRouter (config-pmap-c)# endIdentity Policy Definition
Router (config)# identity policy healthy_policy! The following line is the IP access list for healthy users.Router (config-identity-policy)# access-group healthyRouter (config-identity-policy)# endRouter (config)# identity policy non_healthy_policyRouter (config-identity-policy)# access-group non_healthyRouter (config-identity-policy)# endDefining Access Lists
Router (config)# ip access-list extended healthy_class! The following line can be anything, but as an example, traffic is being allowed.Router (config-ext-nacl)# permit ip any anyRouter (config-ext-nac)# endRouter (config)# ip access-list extended non_healthy_class! The following line is only an example. In practical cases, you could prevent a user from accessing specific networks.Router (config-ext-nacl)# deny ip any anyRouter (config-ext-nac)# endAssociating the Policy Map with the IP Admission Name
Router (config)# ip admission name greentree service-policy type tag global_class! In the next line, the admission name can be associated with the interface.Router (config)# interface fastethernet 1/0Router (config-if)# ip admission greentreeIn the above configuration, if the AAA server sends a tag named "healthy" or "non_healthy" for any host, the policies that are associated with the appropriate identity policy will be applied on the host.
NAC Auth Fail Open Feature Examples
The following example shows how to define an IP admission control rule named "samplerule" and attach it to a specific interface:
Router (config)# ip admission name samplerule eapoudp list 101 event timeout aaa policy identity aaa_fail_policyRouter (config)# interface fastethernet 1/1
Router (config-if)# ip admission samplerule
Router (config-if)# end
In the above configuration, if the specified interface is not already authorized when the AAA server becomes unreachable, it will operate under the specified policy until revalidation is possible.
Related Commands
show eou
To display information about Extensible Authentication Protocol over User Datagram Protocol (EAPoUDP) global values or EAPoUDP session cache entries, use the show eou command in privileged EXEC mode.
show eou {all | authentication {clientless | eap | static} | interface {interface-type} | ip {ip-address} | mac {mac-address} | posturetoken {name}} [{begin | exclude | include} expression]
Syntax Description
all
Displays EAPoUDP information about all clients.
authentication
Authentication type.
clientless
Authentication type is clientless, that is, the endpoint system is not running Cisco Trust Agent (CTA) software.
eap
Authentication type is EAP.
static
Authentication type is statically configured.
interface
Provides information about the interface.
interface-type
Type of interface (see Table 1 for the interface types that may be shown).
ip
Specifies an IP address.
ip-address
IP address of the client device.
mac
Specifies a MAC address.
mac-address
The 48-bit address of the client device.
posturetoken
Displays information about a posture token name.
name
Name of the posture token.
begin
(Optional) Display begins with the line that matches the expression argument.
exclude
(Optional) Display excludes lines that match the expression argument.
include
(Optional) Display includes lines that match the specified expression argument.
expression
(Optional) Expression in the output to use as a reference point.
Command Default
All global EAPoUDP global values are displayed.
Command Modes
Privileged EXEC
Command History
Usage Guidelines
If you do not specify a port, global parameters and a summary appear. If you specify a port, details for that port appear.
Expressions are case sensitive. For example, if you enter "exclude output," the lines that contain "output" are not displayed, but the lines that contain "Output" appear.
Table 1 lists the interface types that may be used for the interface-type argument.
Examples
The following output displays information about a global EAPoUDP configuration. The default values can be changed or customized using the eou default, eou max-retry, eou revalidate, or eou timeout commands, depending on whether you configure them globally or on a specific interface.
Router# show eouGlobal EAPoUDP Configuration----------------------------EAPoUDP Version = 1EAPoUDP Port = 0x5566Clientless Hosts = DisabledIP Station ID = DisabledRevalidation = EnabledRevalidation Period = 36000 SecondsReTransmit Period = 3 SecondsStatusQuery Period = 300 SecondsHold Period = 180 SecondsAAA Timeout = 60 SecondsMax Retries = 3EAPoUDP Logging = DisabledClientless Host Username = clientlessClientless Host Password = clientlessInterface Specific EAPoUDP Configurations-----------------------------------------Interface Ethernet2/1No interface specific configuration
Table 2 describes the significant fields shown in the display.The following output displays information about a global EAPoUDP configuration that includes a NAC Auth Fail Open policy for use when the AAA server is unavailable.Router# show eou ip 10.0.0.1Address : 10.0.0.1 MAC Address : 0001.027c.f364 Interface : Vlan333 AuthType : AAA DOWN AAA Down policy : rule_policy Audit Session ID : 00000000011C11830000000311000001 PostureToken : ------- Age(min) : 0 URL Redirect : NO URL REDIRECT URL Redirect ACL : NO URL REDIRECT ACL ACL Name : rule_acl Tag Name : NO TAG NAME User Name : UNKNOWN USER Revalidation Period : 500 Seconds Status Query Period : 300 Seconds Current State : AAA DOWNTable 2 describes the significant fields shown in the display.
Related Commands
show ip admission
To display the network admission control cache entries or the running network admission control configuration, use the show ip admission command in privileged EXEC mode.
show ip admission {[cache] [configuration] [eapoudp]}
Syntax Description
Command Modes
Privileged EXEC
Command History
12.3(8)T
This command was introduced.
12.4(11)T
The output of this command was enhanced to display whether the AAA timeout policy is configured.
Usage Guidelines
Use this command to display either the IP admission control entries or the running IP admission control configuration. Use show ip admission cache eapoudp to list the host IP addresses, the session timeout, and the posture state. If the posture statue is POSTURE ESTAB, the host validation was successful.
Examples
The following output displays all the IP admission control rules that are configured on the router:
Router# show ip admission configurationAuthentication global cache time is 60 minutesAuthentication global absolute time is 0 minutesAuthentication Proxy Watch-list is disabledAuthentication Proxy Rule ConfigurationAuth-proxy name avruleeapoudp list not specified auth-cache-time 60 minutes
The following output displays the host IP addresses, the session timeout, and the posture states:
Router# show ip admission cache eapoudpPosture Validation Proxy CacheTotal Sessions: 3 Init Sessions: 1Client IP 10.0.0.112, timeout 60, posture state POSTURE ESTABClient IP 10.0.0.142, timeout 60, posture state POSTURE INITClient IP 10.0.0.205, timeout 60, posture state POSTURE ESTABThe following output displays a configuration that includes both a global and a rule-specific NAC Auth Fail Open policy:
Router# show ip admission configurationAuthentication global cache time is 60 minutesAuthentication global absolute time is 0 minutesAuthentication global init state time is 2 minutesAuthentication Proxy Watch-list is enabledWatch-list expiry timeout is 1 minutes! The line below shows the global policy:Authentication global AAA fail identity policy aaa_fail_policyAuthentication Proxy Rule Configuration Auth-proxy name greentreeeapoudp list 101 specified auth-cache-time 60 minutes! The line below shows the rule-specific AAA fail policy; the name changes based on what the user configured.Identity policy name aaa_fail_policy for AAA fail policyThe field descriptions in the display are self-explanatory.
Related Commands
clear ip admission cache
Clears IP admission cache entries from the router.
ip admission name
Creates a Layer 3 network admission control rule.
Feature Information for NAC—Auth Fail Open
Table 3 lists the release history for this feature.
Not all commands may be available in your Cisco IOS software release. For release information about a specific command, see the command reference documentation.
Cisco IOS software images are specific to a Cisco IOS software release, a feature set, and a platform. Use Cisco Feature Navigator to find information about platform support and Cisco IOS software image support. Access Cisco Feature Navigator at http://www.cisco.com/go/fn. You must have an account on Cisco.com. If you do not have an account or have forgotten your username or password, click Cancel at the login dialog box and follow the instructions that appear.
Note
Any Internet Protocol (IP) addresses used in this document are not intended to be actual addresses. Any examples, command display output, and figures included in the document are shown for illustrative purposes only. Any use of actual IP addresses in illustrative content is unintentional and coincidental.
© 2006 Cisco Systems, Inc. All rights reserved.
